Malware detected OSX_REFOGKEYLOGGER.MSGKD15

Hello,

Thank for your answer.

The path/location of the detected file is (copy of scan log):

OSX_REFOGKEYLOGGER.MSGKD15,/Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/4D961BFC-5992-4E2B-8AB8-985942EB4D02.activeSandbox/Root/Library/Apple/System/Library/CoreServices/MRT.app/Contents/MacOS/.BC.T_KiFtlb,Nettoyé,"01/05/2020, 10:56:23"

Thank you for your help.

Chris.

Thank you for your response, christopheveron.

This notification was to let you know that Trend Micro was able to detect and delete the threat right away. Rest assured, your device is safe and no longer infected.

Let me know if you have more questions.

- Cathy

Hello Catherine,

Thank you for your answer,

I found the same problem on the japanese Trend Community : https://ja.community.trendmicro.com/conversations/%E3%82%A6%E3%82%A4%E3%83%AB%E3%82%B9%E3%83%90%E3%82%B9%E3%82%BF%E3%83%BC-for-mac/%E3%82%A6%E3%82%A4%E3%83%AB%E3%82%B9%E3%83%90%E3%82%B9%E3%82%BF%E3%83%BC-for-mac-%E3%81%A7mrt%E3%81%8C%E9%A7%86%E9%99%A4%E3%81%A7%E3%81%8D%E3%81%AA%E3%81%84/5eab70eb35f40c2e79d86e46

Is it a new malware ? Do you consider that the problem is solved or might evolve ?

Thank you for your help.

Christophe.

Thank you for your response, 

christopheveron.

This happens because, the MRT file is a built-in security of Apple. It's possible that the file has been updated thus Trend Micro program detected it. We've immediately had the file reviewed for its integrity and updated our pattern. After a manual update, it should no longer be detected.

You may try the instructions provided on our knowledge-based website to resolve this: 

How to perform manual update 

Hope this helps. Awaiting for your response.

- Rochelle

Hi, ivanfred651.

Upon checking, we have found out that the file is not malicious.

It's possible that the file has been updated thus Trend Micro program detected it. We've immediately had the file reviewed for its integrity and updated our pattern. After a manual update, it should no longer be detected.

You can follow the instruction on the link below on how to do a manual update:

How to perform manual update

Hope this helps. Let us know if you need further assistance.

- Kim